CVE-2026-41178
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 27th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 480
- of 17,787 indexed, latest versions
- Container images
- 444
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
Carried by container images the latest versions of 480 of 17,787 indexed charts deploy, on 444 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.41.0, v1.43.0 | 1.42.0 | 444 |
- OSV records
- GO-2026-5158
- Also known as
- GHSA-5wrp-cwcj-q835
Charts affected
480 by stars
Container images carrying it
444 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| neosmemo/ | 3e1253477066 | go.opentelemetry.io/ | 1.42.0 | 1 |
| netapp/ | 09c6cc6b5f71 | go.opentelemetry.io/ | 1.42.0 | 1 |
| netapp/ | 8235a77cfc92 | go.opentelemetry.io/ | 1.42.0 | 1 |
| netbirdio/ | 3086534361a1 | go.opentelemetry.io/ | 1.42.0 | 1 |
| netbirdio/ | e71f39cefcd9 | go.opentelemetry.io/ | 1.42.0 | 1 |
| netbirdio/ | 3104d5ca3a76 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ngosang/ | a8f9cfa30162 | go.opentelemetry.io/ | 1.42.0 | 1 |
| novosga/ | 34b9acbe6e51 | go.opentelemetry.io/ | 1.42.0 | 1 |
| opencsghq/ | 302c9d45d8a8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| opencsghq/ | 5ea147562ec8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| openpolicyagent/ | 3a8b1bacbcd8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| otel/ | 6ed874ea083d | go.opentelemetry.io/ | 1.42.0 | 1 |
| owncloud/ | 74c53d341076 | go.opentelemetry.io/ | 1.42.0 | 1 |
| owncloud/ | b3f9efdcd7f7 | go.opentelemetry.io/ | 1.42.0 | 1 |
| percona/ | 0214e482b2cd | go.opentelemetry.io/ | 1.42.0 | 1 |
| percona/ | ac4d0995c71e | go.opentelemetry.io/ | 1.42.0 | 1 |
| percona/ | 003f9c25f842 | go.opentelemetry.io/ | 1.42.0 | 1 |
| photoprism/ | 650c6ad5a651 | go.opentelemetry.io/ | 1.42.0 | 1 |
| prometheuscommunity/ | c0a0cbf76570 | go.opentelemetry.io/ | 1.42.0 | 1 |
| prowlercloud/ | 4f252d579be2 | go.opentelemetry.io/ | 1.42.0 | 1 |
| qualys/ | 9ff255352422 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | c2f08e68aed4 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | f9099b5ef8cb | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | 946ae0d13229 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | fe417c28a6b8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | 41cb674d1154 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rancher/ | 1975fac3890f | go.opentelemetry.io/ | 1.42.0 | 1 |
| ravendb/ | 511050205ac5 | go.opentelemetry.io/ | 1.42.0 | 1 |
| redislabs/ | 9078e713bb6a | go.opentelemetry.io/ | 1.42.0 | 1 |
| reportportal/ | 06cdf299b397 | go.opentelemetry.io/ | 1.42.0 | 1 |
| restic/ | 136600b6ff68 | go.opentelemetry.io/ | 1.42.0 | 1 |
| robiningelbrecht/ | 40842cdfd616 | go.opentelemetry.io/ | 1.42.0 | 1 |
| rotationalio/ | f8d8b694515a | go.opentelemetry.io/ | 1.42.0 | 1 |
| scaleway/ | 6d94c970e710 | go.opentelemetry.io/ | 1.42.0 | 1 |
| signoz/ | c10fa03e103c | go.opentelemetry.io/ | 1.42.0 | 1 |
| signoz/ | 72aa1e4c1ec5 | go.opentelemetry.io/ | 1.42.0 | 1 |
| silkeh/ | 900010497f8c | go.opentelemetry.io/ | 1.42.0 | 1 |
| snyk/ | fb5ad76ce84e | go.opentelemetry.io/ | 1.42.0 | 1 |
| solarwinds/ | 3c1110e8bdfb | go.opentelemetry.io/ | 1.42.0 | 1 |
| stevenweathers/ | c7eb7b10f186 | go.opentelemetry.io/ | 1.42.0 | 1 |
| streamnative/ | 77939c8aa269 | go.opentelemetry.io/ | 1.42.0 | 1 |
| streamnative/ | 1886043c24d0 | go.opentelemetry.io/ | 1.42.0 | 1 |
| temporalio/ | dbc5fcd6ee8f | go.opentelemetry.io/ | 1.42.0 | 1 |
| temporalio/ | f14912b699cf | go.opentelemetry.io/ | 1.42.0 | 1 |
| temporalio/ | b5ecdb8282be | go.opentelemetry.io/ | 1.42.0 | 1 |
| tile38/ | 5b61c6f3b32e | go.opentelemetry.io/ | 1.42.0 | 1 |
| treeverse/ | bda61b3fe5d8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| tykio/ | 92509e00e618 | go.opentelemetry.io/ | 1.42.0 | 1 |
| tykio/ | e13d37f298b7 | go.opentelemetry.io/ | 1.42.0 | 1 |
| velero/ | 11459094b1b2 | go.opentelemetry.io/ | 1.42.0 | 1 |